Capita plc

Capita 是一个风险与问责案例，因为其 2023 年网络事件显示，即使受影响的系统位于私人外包集团内部，供应商攻击也可能成为公共服务问题。问题不仅在于 Capita 在未授权访问、服务中断和数据泄露后是否恢复了系统。还在于公民、养老金成员、员工、地方当局、公共机构、受托人、私人客户、监管机构和投资者能否看到足够的证据，以了解哪些外包服务受到影响，哪些个人数据已被复制，谁必须通知谁，以及运营控制是否已从公共机构转移而没有将问责一并转移。

Capita is a risk and accountability case because its 2023 cyber incident showed how a supplier compromise can become a public-services problem even when the affected systems sit inside a private outsourcing group. The issue is not only whether Capita restored systems after unauthorized access, service disruption, and data exfiltration. The issue is whether citizens, pension members, employees, local authorities, public agencies, trustees, private clients, regulators, and investors could see enough evidence to understand which outsourced services were affected, which personal data had been copied, who had to notify whom, and whether operational control had been moved away from the public body